Suppose you have a network like this:

                   +-------------------------+         +---------------------------+
                   |                         |         |                           |
                   |                         |         |                           |
+--------+         |           core          |---------|           core            |
| radius |---------|         switch #1       |---------|         switch #2         |
| server |         |                         |         |                           |
+--------+         |                         |         |                           |
                   +-------------------------+         +---------------------------+
                         |            |                      |               |
                   +-----------+ +-----------+         +-------------+ +-----------+
                   |  access   | |  access   |         |   access    | |  access   |
                   | switch #1 | | switch #2 |         | switch #N-1 | | switch #N |
                   +-----------+ +-----------+         +-------------+ +-----------+

I want to make sure that it is not possible to connect a device (pc or another switch) to the network that is not allowed. Therefore I am thinking about using 802.1x to authenticate the switches. My plan is to follow the best practices as explained in slides 79 and 80 of this presentation.

The problem raises when I need to connect the two core switches with multiple ethernet cables because 1Gbps is not enough but using a fiber is too expensive.

I am reading this document from HP where they say

To help maintain security, the switch does not allow 802.1X and LACP to both be enabled at the same time on the same port.

So I am wondering if this limitation is due to the HP products or by the design of the protocols.

My main doubt is that an attacker unplugs one of the ethernet cables between the core switches and attaches another switch, which can intercept the traffic since the switch is not using 802.1x on the trunk ports.

It it possile to use 802.1x with trunk ports?

  • 2
    802.1X is not all that secure. Search for bypass 802.1X. You can buy an inexpensive Raspberry Pi, download some software, and off you go. What you are really asking is it possible for a switch to be an 802.1X client, and that is going to depend on the switch make and model. If HP says it can't be done on its switches, then I would have to assume it can't be done on HP switches. If you disconnect on port in a channel, you probably can't use that port with a different device anyway, you would need to disconnect both to use one.
    – Ron Maupin
    Feb 19 '16 at 15:19
  • LACP ports function as normal access ports until the link partner negotiates and joins the LACP bundle. But otherwise, you're spot on w.r.t. switches acting as a client. I have hardware from 7 different vendors, and none of them can be a client.
    – Ricky
    Feb 19 '16 at 21:07
  • 802.1X and LACP generally don't mix. LACP is protocol-backed link aggregation that you use for interconnects (core or core-access). 802.1X is port authentication that you only use on the network's edge (if at all). 802.1X simply doesn't support aggregated connections.
    – Zac67
    Jun 14 '18 at 17:13

802.1x was specifically designed for end-point devices to authenticate to network switches and was not designed for switch-to-switch connections. Because of this, it is highly unlikely that you will find any switches that can be a 802.1x client, so the answer to your Y question is no.

To answer your X concern (see XY problem)- preventing a malicious entity from monitoring and intercepting traffic can only be reasonably accomplished by maintaining physical security of your network hardware and cabling infrastructure. As @Ron mentioned, it is trivial to configure a device to act as a network tap that can be placed between any one of your switches -provided that physical access can be attained- that can then passively monitor traffic on your network, regardless of whether you have 802.1x configured. MACSEC would be an example of a technical measure that could potentially prevent this type of attack.

  • 1
    I did not know MACsec, it's probably what I'm looking for, since I can't guarantee physical integrity and security to the LAN. Feb 20 '16 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.